CVE-2020-27956

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-279575.4The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of gameCVE-2020-279584.3The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to pCVE-2020-27968.2Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affectCVE-2020-279697.3Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofingCVE-2020-27976.1Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that CVE-2020-279705.3Yandex Browser before 20.10.0 allows remote attackers to spoof the address barCVE-2020-279746.1NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.CVE-2020-279758.8osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.CVE-2020-279769.8osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to theCVE-2020-279777.8CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry vaCVE-2020-279787.5Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigCVE-2020-27987.2Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services). Supported versions that are a